@optimuslabs/harness-map-staging 1.5.25 → 1.5.27

package/dist/log_config_files/runtime/main_runner.js

@@ -15,7 +15,7 @@ import { ensureAuthentication } from '../auth/auth_flow.js';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
-import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectGrokCliVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
+import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectClaudeDesktopOrgs, collectGrokCliVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
 import { ensureCursorUserSettingsSnapshotInBatch } from '../collection/ensure_cursor_user_settings_snapshot.js';
 import { collectSkillsCliInstalled } from '../collection/skills_cli_collector.js';
 import { collectWorkspaceVscdbs } from '../collection/mcp_tool_collector.js';
@@ -26,8 +26,36 @@ import { canonicalCursorUserStateVscdbPath } from './remediation_config_path.js'
 import { ensureWorkspaceRepoEnv, resolveProjectRoot } from './workspace_repo.js';
 import { scanActiveWorktrees, activeWorktreeRootSet, filterConfigFilesToActiveWorktrees, } from './worktree_scanner.js';
 import { createSignature, canonicalizePayload } from '../sender/signing.js';
+import { withClaudeLoginPlan } from '../collection/claude_login_plan.js';
 const PROJECT_ROOT = resolveProjectRoot();
-async function collectAllConfigFiles(endpointBase) {
+const configFileKey = (c) => `${c.file_type}\t${c.file_path}`;
+/** Appends the entries not in the batch yet (by file type and path), recording each as seen. */
+function addUnseen(configFiles, seen, entries) {
+    for (const entry of entries) {
+        const key = configFileKey(entry);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        configFiles.push(entry);
+    }
+}
+/** Machine-wide collectors, run in this order after the plugin caches: [hook log line, collector]. */
+const HOME_COLLECTORS = [
+    ['scanning Claude known projects from ~/.claude.json', collectMcpFromClaudeJsonProjects],
+    ['aggregating Claude token usage from ~/.claude/projects transcripts', collectClaudeTokenUsage],
+    ['aggregating Copilot token usage from ~/.copilot/session-state transcripts', collectCopilotTokenUsage],
+    ['aggregating OpenCode token usage from ~/.local/share/opencode/opencode.db', collectOpencodeTokenUsage],
+    ['aggregating Codex token usage from ~/.codex/sessions rollouts', collectCodexTokenUsage],
+    ['aggregating Cursor token usage from state.vscdb', collectCursorTokenUsage],
+    ['aggregating Hermes token usage from ~/.hermes/state.db', collectHermesTokenUsage],
+    ['aggregating OpenClaw token usage from ~/.openclaw/agents/*/sessions/sessions.json', collectOpenclawTokenUsage],
+    ['aggregating Pi token usage from ~/.pi/agent/sessions transcripts', collectPiTokenUsage],
+    ["reading Claude Desktop app version for Cowork's Agent Profile", collectCoworkDesktopVersion],
+    ["reading the orgs Claude Desktop's signed-in account has used", collectClaudeDesktopOrgs],
+    ['reading Grok CLI version', collectGrokCliVersion],
+];
+/** The file-path-registry patterns from the API; throws when none came back. */
+async function fetchPatterns(endpointBase) {
     const patternsUrl = `${endpointBase.replace(/\/+$/, '')}${FILE_PATH_REGISTRY_FILE_PATTERNS_PATH}`;
     hookRunLog(`fetching patterns from ${patternsUrl}`);
     const patternsResponse = await getFileCollectionPatterns(endpointBase);
@@ -38,9 +66,12 @@ async function collectAllConfigFiles(endpointBase) {
         hookRunLog(msg);
         throw new Error(msg);
     }
+    return patternsResponse;
+}
+function scanPatterns(patternsResponse) {
     persistVscdbComposerContractFromPatternsResponse(patternsResponse);
     hookRunLog(`scanning config files`);
-    const configFiles = collectConfigFilesFromPatterns(patternsResponse.patterns, PROJECT_ROOT, hookRunLog, {
+    const files = collectConfigFilesFromPatterns(patternsResponse.patterns, PROJECT_ROOT, hookRunLog, {
         vscdbEntrySpecs: patternsResponse.vscdb_entry_specs,
         vscdb_read_queries: patternsResponse.vscdb_read_queries,
         vscdb_merge_from_composer_state: patternsResponse.vscdb_merge_from_composer_state,
@@ -50,163 +81,32 @@ async function collectAllConfigFiles(endpointBase) {
         absolute_path_prefixes: patternsResponse.absolute_path_prefixes,
         mcp_tool_glob_spec: patternsResponse.mcp_tool_glob_spec ?? null,
     });
+    return withClaudeLoginPlan(files, HOME_DIR);
+}
+/** MCP tool caches: the global cache, Cursor's per-project caches and its workspace vscdb files. */
+function addMcpToolCaches(patternsResponse, configFiles, seen) {
     hookRunLog(`scanning MCP tool cache`);
     const mcpToolGlobPattern = patternsResponse.patterns.find((p) => p.path_resolution === 'mcp_tool_glob');
     const mcpToolSkipPrefixes = normalizePathSkipPrefixes(mcpToolGlobPattern?.path_skip_prefixes);
-    const existingPaths = new Set(configFiles.map((c) => `${c.file_type}\t${c.file_path}`));
-    for (const m of collectMcpToolFiles(mcpToolSkipPrefixes, patternsResponse.client_path_constants)) {
-        const key = `${m.file_type}\t${m.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(m);
-        }
-    }
+    addUnseen(configFiles, seen, collectMcpToolFiles(mcpToolSkipPrefixes, patternsResponse.client_path_constants));
     hookRunLog(`scanning Cursor project workspace MCP configs (~/.cursor/projects/*/mcp-cache.json)`);
-    for (const m of collectCursorProjectWorkspaceMcpConfigs(mcpToolSkipPrefixes, patternsResponse.client_path_constants, patternsResponse.workspace_vscdb_spec, HOME_DIR)) {
-        const key = `${m.file_type}\t${m.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(m);
-        }
-    }
+    addUnseen(configFiles, seen, collectCursorProjectWorkspaceMcpConfigs(mcpToolSkipPrefixes, patternsResponse.client_path_constants, patternsResponse.workspace_vscdb_spec, HOME_DIR));
     if (patternsResponse.workspace_vscdb_spec) {
         hookRunLog(`scanning Cursor workspace vscdb files`);
-        for (const m of collectWorkspaceVscdbs(patternsResponse.workspace_vscdb_spec)) {
-            const key = `${m.file_type}\t${m.file_path}`;
-            if (!existingPaths.has(key)) {
-                existingPaths.add(key);
-                configFiles.push(m);
-            }
-        }
-    }
-    hookRunLog(`scanning installed plugins`);
-    if (!patternsResponse.client_path_constants)
-        throw new Error('client_path_constants required from API response');
-    configFiles.push(...collectConfigFilesFromInstalledPlugins(patternsResponse.client_path_constants));
-    hookRunLog(`scanning Claude plugin cache MCP manifests`);
-    for (const entry of collectPluginCacheMcpFiles(patternsResponse.client_path_constants, HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`scanning Claude known projects from ~/.claude.json`);
-    for (const entry of collectMcpFromClaudeJsonProjects(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Claude token usage from ~/.claude/projects transcripts`);
-    for (const entry of collectClaudeTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Copilot token usage from ~/.copilot/session-state transcripts`);
-    for (const entry of collectCopilotTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating OpenCode token usage from ~/.local/share/opencode/opencode.db`);
-    for (const entry of collectOpencodeTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Codex token usage from ~/.codex/sessions rollouts`);
-    for (const entry of collectCodexTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Cursor token usage from state.vscdb`);
-    for (const entry of collectCursorTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Hermes token usage from ~/.hermes/state.db`);
-    for (const entry of collectHermesTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating OpenClaw token usage from ~/.openclaw/agents/*/sessions/sessions.json`);
-    for (const entry of collectOpenclawTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`aggregating Pi token usage from ~/.pi/agent/sessions transcripts`);
-    for (const entry of collectPiTokenUsage(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`reading Claude Desktop app version for Cowork's Agent Profile`);
-    for (const entry of collectCoworkDesktopVersion(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
-    hookRunLog(`reading Grok CLI version`);
-    for (const entry of collectGrokCliVersion(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
+        addUnseen(configFiles, seen, collectWorkspaceVscdbs(patternsResponse.workspace_vscdb_spec));
     }
+}
+function addClaudeDesktopExtensions(configFiles, seen) {
     hookRunLog(`merging disk-only Claude Desktop extensions into extensions-installations.json`);
     const diskExtMerge = enrichClaudeDesktopExtensionsInstallationsUpload(configFiles, HOME_DIR);
     hookRunLog(`claude desktop extensions: merged=${diskExtMerge.mergedCount} had_registry_upload=${diskExtMerge.hadRegistryUpload}`);
-    for (const entry of collectClaudeDesktopExtensionSettingsFiles(HOME_DIR)) {
-        const key = `${entry.file_type}\t${entry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(entry);
-        }
-    }
+    addUnseen(configFiles, seen, collectClaudeDesktopExtensionSettingsFiles(HOME_DIR));
     if (!diskExtMerge.hadRegistryUpload && diskExtMerge.mergedCount > 0) {
         hookRunLog(`scanning Claude Desktop extension manifests on disk (no registry upload in batch)`);
-        for (const entry of collectClaudeDesktopExtensionManifests(HOME_DIR)) {
-            const key = `${entry.file_type}\t${entry.file_path}`;
-            if (!existingPaths.has(key)) {
-                existingPaths.add(key);
-                configFiles.push(entry);
-            }
-        }
-    }
-    const skillsCliEntry = collectSkillsCliInstalled(PROJECT_ROOT, hookRunLog);
-    if (skillsCliEntry) {
-        const key = `${skillsCliEntry.file_type}\t${skillsCliEntry.file_path}`;
-        if (!existingPaths.has(key)) {
-            existingPaths.add(key);
-            configFiles.push(skillsCliEntry);
-        }
+        addUnseen(configFiles, seen, collectClaudeDesktopExtensionManifests(HOME_DIR));
     }
+}
+function filterToActiveWorktrees(configFiles) {
     const worktreeReport = scanActiveWorktrees(PROJECT_ROOT, HOME_DIR);
     const activeRoots = activeWorktreeRootSet(worktreeReport);
     const beforeFilter = configFiles.length;
@@ -214,6 +114,28 @@ async function collectAllConfigFiles(endpointBase) {
     hookRunLog(`worktree_scan: active=${worktreeReport.length} config_files ${beforeFilter}→${filtered.length}`);
     return { configFiles: filtered, worktreeReport };
 }
+async function collectAllConfigFiles(endpointBase) {
+    const patternsResponse = await fetchPatterns(endpointBase);
+    const configFiles = scanPatterns(patternsResponse);
+    const seen = new Set(configFiles.map(configFileKey));
+    addMcpToolCaches(patternsResponse, configFiles, seen);
+    hookRunLog(`scanning installed plugins`);
+    const clientPathConstants = patternsResponse.client_path_constants;
+    if (!clientPathConstants)
+        throw new Error('client_path_constants required from API response');
+    configFiles.push(...collectConfigFilesFromInstalledPlugins(clientPathConstants));
+    hookRunLog(`scanning Claude plugin cache MCP manifests`);
+    addUnseen(configFiles, seen, collectPluginCacheMcpFiles(clientPathConstants, HOME_DIR));
+    for (const [message, collect] of HOME_COLLECTORS) {
+        hookRunLog(message);
+        addUnseen(configFiles, seen, collect(HOME_DIR));
+    }
+    addClaudeDesktopExtensions(configFiles, seen);
+    const skillsCliEntry = collectSkillsCliInstalled(PROJECT_ROOT, hookRunLog);
+    if (skillsCliEntry)
+        addUnseen(configFiles, seen, [skillsCliEntry]);
+    return filterToActiveWorktrees(configFiles);
+}
 /** Adds the sensitive paths audit to the batch; false when it could not be run (nothing added). */
 async function addSensitivePathsAudit(endpointBase, configFiles) {
     hookRunLog(`running sensitive paths audit`);

package/dist/log_config_files/runtime/management_storage.js

@@ -2,7 +2,7 @@
  * Paths and JSON persistence for ~/.optimuslabs/management:
  * - remediation_instructions.json (remediations[])
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { OPTIMUSLABS_MANAGEMENT_REL, OPTIMUSLABS_LOGS_REL } from '../../bootstrap_constants.js';
@@ -129,7 +129,51 @@ function parseInstructionsRaw(raw) {
     }
 }
 export function writeRemediationInstructionsFile(file) {
-    atomicWriteJson(getRemediationInstructionsPath(), file);
+    writeInstructionsFile(file, new Date().toISOString());
+}
+function writeInstructionsFile(file, remediationsWrittenAt) {
+    // Most callers write `{ remediations }` only; keep the approval lists they didn't pass.
+    const onDisk = readRemediationInstructionsFile();
+    const approved_tenants = 'approved_tenants' in file ? file.approved_tenants : onDisk.approved_tenants;
+    const unapproved_email_domains = 'unapproved_email_domains' in file ? file.unapproved_email_domains : onDisk.unapproved_email_domains;
+    const allowed_email_domains = 'allowed_email_domains' in file ? file.allowed_email_domains : onDisk.allowed_email_domains;
+    const approved_agents = 'approved_agents' in file ? file.approved_agents : onDisk.approved_agents;
+    atomicWriteJson(getRemediationInstructionsPath(), {
+        ...file,
+        ...(approved_tenants === undefined ? {} : { approved_tenants }),
+        ...(unapproved_email_domains === undefined ? {} : { unapproved_email_domains }),
+        ...(allowed_email_domains === undefined ? {} : { allowed_email_domains }),
+        ...(approved_agents === undefined ? {} : { approved_agents }),
+        remediations_written_at: remediationsWrittenAt,
+    });
+}
+/** When the remediations on disk were written: recorded, or for an older file its mtime. */
+function remediationsWrittenAtOf(onDisk) {
+    if (onDisk.remediations_written_at)
+        return onDisk.remediations_written_at;
+    const path = getRemediationInstructionsPath();
+    return existsSync(path) ? statSync(path).mtime.toISOString() : new Date().toISOString();
+}
+/** Replace one approval list, keeping the remediations and when they were written. */
+function writeApprovalList(patch) {
+    const onDisk = readRemediationInstructionsFile();
+    writeInstructionsFile({ ...onDisk, ...patch }, remediationsWrittenAtOf(onDisk));
+}
+/** Replace only the unapproved email domains, keeping everything else on disk. */
+export function writeUnapprovedEmailDomains(unapproved_email_domains) {
+    writeApprovalList({ unapproved_email_domains });
+}
+/** Replace only the approved agents, keeping everything else on disk. */
+export function writeApprovedAgents(approved_agents) {
+    writeApprovalList({ approved_agents });
+}
+/** Replace only the email allowlist, keeping everything else on disk. */
+export function writeAllowedEmailDomains(allowed_email_domains) {
+    writeApprovalList({ allowed_email_domains });
+}
+/** Replace only the approved-tenant list, keeping the remediations already on disk. */
+export function writeApprovedTenants(approved_tenants) {
+    writeApprovalList({ approved_tenants });
 }
 export function readRemediationInstructionsFile() {
     const path = getRemediationInstructionsPath();

package/dist/log_config_files/runtime/remediation_sync.js

@@ -4,7 +4,7 @@ import { homedir } from 'node:os';
 import { executeBody } from '../../endpoint_client/http_transport.js';
 import { parseJsonWithJsoncFallback, parseTomlText, stringifyToml } from '../readers/file_readers.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
-import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
+import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeApprovedTenants, writeUnapprovedEmailDomains, writeAllowedEmailDomains, writeApprovedAgents, writeRemediationInstructionsFile, } from './management_storage.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 import { createSignature } from '../sender/signing.js';
@@ -1600,123 +1600,172 @@ export function reportAutofixApplied(remediationUuid, result, details) {
 // ---------------------------------------------------------------------------
 // Main entry point
 // ---------------------------------------------------------------------------
-export async function syncRemediations(endpointBase, machineUuid) {
-    let remediations = readInstructions().remediations;
-    const activeUuids = remediations.map((r) => r.uuid);
-    complianceRunnerDiag(`remediation_sync: begin endpoint=${endpointBase} machine_uuid=${machineUuid} local_rows=${remediations.length}`);
+const errorText = (err) => (err instanceof Error ? err.message : String(err));
+/** The strings in a synced list, lowercased; anything else in it is dropped. */
+function lowercaseStrings(list) {
+    return list.filter((v) => typeof v === 'string').map((v) => v.toLowerCase());
+}
+async function ensureVscdbContract(endpointBase) {
     try {
-        if (!existsSync(getFileCollectionVscdbContractPath())) {
-            const pr = await getFileCollectionPatterns(endpointBase);
-            if (pr)
-                persistVscdbComposerContractFromPatternsResponse(pr);
-        }
+        if (existsSync(getFileCollectionVscdbContractPath()))
+            return;
+        const pr = await getFileCollectionPatterns(endpointBase);
+        if (pr)
+            persistVscdbComposerContractFromPatternsResponse(pr);
     }
     catch {
         /* contract also written on full log-config run */
     }
+}
+/** The server's sync answer, or null (logged) when the request failed or came back empty. */
+async function fetchSyncResult(endpointBase, machineUuid, activeUuids) {
     let syncResult;
     try {
         syncResult = await fetchSync(endpointBase, machineUuid, activeUuids);
     }
     catch (err) {
-        const msg = `remediation_sync_error: ${err instanceof Error ? err.message : String(err)}`;
+        const msg = `remediation_sync_error: ${errorText(err)}`;
         hookRunLog(msg);
         complianceRunnerDiag(msg);
-        return;
+        return null;
     }
     if (!syncResult) {
         hookRunLog(`remediation_sync: no response from server, skipping`);
         complianceRunnerDiag('remediation_sync: no response from server (non-200 or empty body), skipping');
-        return;
     }
-    applyClearApplyTrackingUuids(syncResult.clear_apply_tracking_uuids);
-    if (syncResult.status === 'unchanged') {
-        hookRunLog(`remediation_sync: unchanged enforced=${activeUuids.length}`);
-        complianceRunnerDiag(`remediation_sync: server status=unchanged local_uuids=${activeUuids.length} — no new rows to fetch; if a deploy should exist, verify Finding.machine matches this hardware_uuid`);
-        const want = new Set(activeUuids);
-        const have = new Map(remediations.map((r) => [r.uuid, r]));
-        const needBackfill = activeUuids.some((u) => !have.has(u));
-        const haveIncomplete = remediations.some((r) => want.has(r.uuid) && needsManifestRefetch(r));
-        const haveOrphan = remediations.some((r) => !want.has(r.uuid));
-        const path = getRemediationInstructionsPath();
-        if (activeUuids.length > 0) {
-            if (needBackfill || haveIncomplete || haveOrphan || !existsSync(path)) {
-                try {
-                    await ensureInstructionsForUuids(endpointBase, machineUuid, want, null);
-                }
-                catch (err) {
-                    hookRunLog(`remediation_instructions_reconcile_error: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-        else if (remediations.length > 0) {
-            try {
-                await ensureInstructionsForUuids(endpointBase, machineUuid, new Set(), null);
-            }
-            catch (err) {
-                hookRunLog(`remediation_instructions_reconcile_error: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
+    return syncResult;
+}
+/**
+ * Kept locally so the prompt gate checks the signed-in tenant without a round trip; a failed
+ * sync never gets here and leaves the last lists in place.
+ */
+function storeApprovals(syncResult) {
+    const approvedTenants = syncResult.approved_tenants;
+    if (approvedTenants && typeof approvedTenants === 'object' && !Array.isArray(approvedTenants)) {
+        writeApprovedTenants(approvedTenants);
+    }
+    const unapprovedDomains = syncResult.unapproved_email_domains;
+    if (Array.isArray(unapprovedDomains))
+        writeUnapprovedEmailDomains(lowercaseStrings(unapprovedDomains));
+    const approvedAgents = syncResult.approved_agents;
+    if (Array.isArray(approvedAgents))
+        writeApprovedAgents(lowercaseStrings(approvedAgents));
+    const allowedDomains = syncResult.allowed_email_domains;
+    if (Array.isArray(allowedDomains))
+        writeAllowedEmailDomains(lowercaseStrings(allowedDomains));
+}
+async function reconcileInstructions(endpointBase, machineUuid, want) {
+    try {
+        await ensureInstructionsForUuids(endpointBase, machineUuid, want, null);
+    }
+    catch (err) {
+        hookRunLog(`remediation_instructions_reconcile_error: ${errorText(err)}`);
+    }
+}
+/** Server says nothing changed: still repair a local file that is missing rows, incomplete or stale. */
+async function reconcileUnchanged(endpointBase, machineUuid, remediations, activeUuids) {
+    hookRunLog(`remediation_sync: unchanged enforced=${activeUuids.length}`);
+    complianceRunnerDiag(`remediation_sync: server status=unchanged local_uuids=${activeUuids.length} — no new rows to fetch; if a deploy should exist, verify Finding.machine matches this hardware_uuid`);
+    const want = new Set(activeUuids);
+    if (activeUuids.length === 0) {
+        if (remediations.length > 0)
+            await reconcileInstructions(endpointBase, machineUuid, new Set());
         return;
     }
-    const { added, removed } = syncResult;
-    hookRunLog(`remediation_sync: status=updated added=${added.length} removed=${removed.length}`);
-    complianceRunnerDiag(`remediation_sync: server status=updated added=${JSON.stringify(added)} removed=${JSON.stringify(removed)}`);
-    const removedSet = new Set(removed);
-    const retiredInstructions = remediations.filter((r) => removedSet.has(r.uuid));
-    let removedCount = 0;
-    remediations = remediations.filter((r) => {
-        if (removedSet.has(r.uuid)) {
-            removedCount++;
-            hookRunLog(`remediation_remove: uuid=${r.uuid} path=${r.config_file_path}`);
-            return false;
-        }
-        return true;
-    });
-    let manifest = null;
-    if (added.length > 0) {
-        try {
-            manifest = await fetchManifest(endpointBase, machineUuid, added);
-        }
-        catch (err) {
-            const msg = `remediation_manifest_error: ${err instanceof Error ? err.message : String(err)}`;
-            hookRunLog(msg);
-            complianceRunnerDiag(msg);
-            if (removedCount > 0) {
-                remediations.sort((a, b) => a.uuid.localeCompare(b.uuid));
-                writeInstructions({ remediations });
-            }
-            return;
-        }
-        if (!manifest) {
-            hookRunLog(`remediation_sync: manifest fetch failed, skipping`);
-            complianceRunnerDiag('remediation_sync: manifest fetch failed (null), skipping — remediation_instructions.json not updated');
-            if (removedCount > 0) {
-                remediations.sort((a, b) => a.uuid.localeCompare(b.uuid));
-                writeInstructions({ remediations });
-            }
-            return;
-        }
+    const have = new Map(remediations.map((r) => [r.uuid, r]));
+    const needBackfill = activeUuids.some((u) => !have.has(u));
+    const haveIncomplete = remediations.some((r) => want.has(r.uuid) && needsManifestRefetch(r));
+    const haveOrphan = remediations.some((r) => !want.has(r.uuid));
+    if (needBackfill || haveIncomplete || haveOrphan || !existsSync(getRemediationInstructionsPath())) {
+        await reconcileInstructions(endpointBase, machineUuid, want);
+    }
+}
+function writeSortedInstructions(remediations) {
+    remediations.sort((a, b) => a.uuid.localeCompare(b.uuid));
+    writeInstructions({ remediations });
+}
+/** The manifest rows for the added UUIDs; null (logged) when it could not be fetched. */
+async function fetchAddedManifest(endpointBase, machineUuid, added) {
+    let manifest;
+    try {
+        manifest = await fetchManifest(endpointBase, machineUuid, added);
+    }
+    catch (err) {
+        const msg = `remediation_manifest_error: ${errorText(err)}`;
+        hookRunLog(msg);
+        complianceRunnerDiag(msg);
+        return null;
+    }
+    if (!manifest) {
+        hookRunLog(`remediation_sync: manifest fetch failed, skipping`);
+        complianceRunnerDiag('remediation_sync: manifest fetch failed (null), skipping — remediation_instructions.json not updated');
+    }
+    return manifest;
+}
+function upsertInstruction(remediations, existingUuids, instruction) {
+    if (!existingUuids.has(instruction.uuid)) {
+        remediations.push(instruction);
+        existingUuids.add(instruction.uuid);
+        return;
     }
+    // Enforced remediations are always in `added`; overwrite local copy with fresh server data.
+    const idx = remediations.findIndex((r) => r.uuid === instruction.uuid);
+    if (idx >= 0)
+        remediations[idx] = instruction;
+}
+/** Put the manifest's added rows into `remediations` (replacing a local copy); returns the rows put in. */
+function mergeAddedInstructions(remediations, manifest, added) {
     const existingUuids = new Set(remediations.map((r) => r.uuid));
     const addedSet = new Set(added);
     const overlay = [];
-    for (const instruction of manifest ?? []) {
+    for (const instruction of manifest) {
         if (!addedSet.has(instruction.uuid))
             continue;
-        if (existingUuids.has(instruction.uuid)) {
-            // Enforced remediations are always in `added`; overwrite local copy with fresh server data.
-            const idx = remediations.findIndex((r) => r.uuid === instruction.uuid);
-            if (idx >= 0)
-                remediations[idx] = instruction;
-        }
-        else {
-            remediations.push(instruction);
-            existingUuids.add(instruction.uuid);
-        }
+        upsertInstruction(remediations, existingUuids, instruction);
         overlay.push(instruction);
         hookRunLog(`remediation_instructions_saved: uuid=${instruction.uuid} path=${instruction.config_file_path}`);
     }
+    return overlay;
+}
+/** Write the merged instructions, fetch anything still missing, and report the new UUID set. */
+async function persistSyncedInstructions(endpointBase, machineUuid, remediations, overlay, removedCount) {
+    writeSortedInstructions(remediations);
+    complianceRunnerDiag(`remediation_sync: wrote ${getRemediationInstructionsPath()} rows=${remediations.length} (added_from_manifest=${overlay.length} removed=${removedCount})`);
+    const finalWant = new Set(remediations.map((r) => r.uuid));
+    try {
+        await ensureInstructionsForUuids(endpointBase, machineUuid, finalWant, overlay.length > 0 ? overlay : null);
+    }
+    catch (err) {
+        hookRunLog(`remediation_instructions_persist_error: ${errorText(err)}`);
+    }
+    // Post-sync heartbeat: report the updated UUID set so the server has a before/after pair.
+    const finalUuids = remediations.map((r) => r.uuid);
+    try {
+        await fetchSync(endpointBase, machineUuid, finalUuids);
+        hookRunLog(`remediation_sync: post-sync heartbeat reported uuids=${finalUuids.length}`);
+    }
+    catch {
+        // Non-critical — skip silently.
+    }
+}
+/** Server sent added/removed UUIDs: drop the removed, fetch and merge the added, then persist. */
+async function applySyncUpdate(endpointBase, machineUuid, local, syncResult) {
+    const { added, removed } = syncResult;
+    hookRunLog(`remediation_sync: status=updated added=${added.length} removed=${removed.length}`);
+    complianceRunnerDiag(`remediation_sync: server status=updated added=${JSON.stringify(added)} removed=${JSON.stringify(removed)}`);
+    const removedSet = new Set(removed);
+    const retiredInstructions = local.filter((r) => removedSet.has(r.uuid));
+    for (const r of retiredInstructions)
+        hookRunLog(`remediation_remove: uuid=${r.uuid} path=${r.config_file_path}`);
+    const removedCount = retiredInstructions.length;
+    const remediations = local.filter((r) => !removedSet.has(r.uuid));
+    const manifest = added.length > 0 ? await fetchAddedManifest(endpointBase, machineUuid, added) : [];
+    if (!manifest) {
+        if (removedCount > 0)
+            writeSortedInstructions(remediations);
+        return;
+    }
+    const overlay = mergeAddedInstructions(remediations, manifest, added);
     transferQuarantineForRetiredUuids(removed, added, retiredInstructions, overlay);
     const addedCount = overlay.length;
     if (added.length > 0 && addedCount === 0) {
@@ -1725,26 +1774,24 @@ export async function syncRemediations(endpointBase, machineUuid) {
         complianceRunnerDiag(`${msg} — remediation_instructions.json not written`);
     }
     if (removedCount > 0 || addedCount > 0) {
-        remediations.sort((a, b) => a.uuid.localeCompare(b.uuid));
-        writeInstructions({ remediations });
-        complianceRunnerDiag(`remediation_sync: wrote ${getRemediationInstructionsPath()} rows=${remediations.length} (added_from_manifest=${addedCount} removed=${removedCount})`);
-        const finalWant = new Set(remediations.map((r) => r.uuid));
-        try {
-            await ensureInstructionsForUuids(endpointBase, machineUuid, finalWant, overlay.length > 0 ? overlay : null);
-        }
-        catch (err) {
-            hookRunLog(`remediation_instructions_persist_error: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        // Post-sync heartbeat: report the updated UUID set so the server has a before/after pair.
-        const finalUuids = remediations.map((r) => r.uuid);
-        try {
-            await fetchSync(endpointBase, machineUuid, finalUuids);
-            hookRunLog(`remediation_sync: post-sync heartbeat reported uuids=${finalUuids.length}`);
-        }
-        catch {
-            // Non-critical — skip silently.
-        }
+        await persistSyncedInstructions(endpointBase, machineUuid, remediations, overlay, removedCount);
     }
     hookRunLog(`remediation_sync: saved=${addedCount} removed=${removedCount}`);
     complianceRunnerDiag(`remediation_sync: done saved=${addedCount} removed=${removedCount}`);
 }
+export async function syncRemediations(endpointBase, machineUuid) {
+    const remediations = readInstructions().remediations;
+    const activeUuids = remediations.map((r) => r.uuid);
+    complianceRunnerDiag(`remediation_sync: begin endpoint=${endpointBase} machine_uuid=${machineUuid} local_rows=${remediations.length}`);
+    await ensureVscdbContract(endpointBase);
+    const syncResult = await fetchSyncResult(endpointBase, machineUuid, activeUuids);
+    if (!syncResult)
+        return;
+    applyClearApplyTrackingUuids(syncResult.clear_apply_tracking_uuids);
+    storeApprovals(syncResult);
+    if (syncResult.status === 'unchanged') {
+        await reconcileUnchanged(endpointBase, machineUuid, remediations, activeUuids);
+        return;
+    }
+    await applySyncUpdate(endpointBase, machineUuid, remediations, syncResult);
+}